Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.3

OpenClaw 2026.3.22 and Earlier Allows Bypass of Access Controls

CVE-2026-35649 · published 6 months ago
Summary

OpenClaw, a software tool, has a setting issue that can allow attackers to access things they shouldn't. This is because of a mistake in how the software handles lists of allowed actions. To fix this, update OpenClaw to version 2026.3.22 or later.

Original advisory text
OpenClaw before 2026.3.22 contains a settings reconciliation vulnerability that allows attackers to bypass intended deny-all revocations by exploiting empty allowlist handling. The vulnerability tr...
OpenClaw before 2026.3.22 contains a settings reconciliation vulnerability that allows attackers to bypass intended deny-all revocations by exploiting empty allowlist handling. The vulnerability treats explicit empty allowlists as unset during reconciliation, silently undoing intended access control denials and restoring previously revoked permissions.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-183Permissive List of Allowed Inputs
Timeline
Published10 Apr 2026
Updated3 Nov 2026
First seen10 Apr 2026
Sources
CVE-2026-35649 · NVD
Track software like this
Free during beta